The IPv6 neighbor discovery (ND) process uses ICMP messages for address resolution, neighbor reachability verification, and neighboring device tracking.

Table 1 describes the ICMPv6 messages used by the IPv6 ND protocol.

Table 1 ICMPv6 messages used by ND

ICMPv6 message	Type	Function
Neighbor Solicitation (NS)	135	Acquires the link-layer address of a neighbor on the local link.
		Verifies the reachability of a neighbor.
		Detects duplicate addresses.
Neighbor Advertisement (NA)	136	Responds to an NS message.
Neighbor Advertisement (NA)	136	Notifies the neighboring nodes of link layer changes.
Router Solicitation (RS)	133	Requests an address prefix and other configuration information for autoconfiguration after startup.
Router Advertisement (RA)	134	Responds to an RS message.
Router Advertisement (RA)	134	Advertises information, such as the Prefix Information options and flag bits.
Redirect	137	Informs the source host of a better next hop on the path to a particular destination when certain conditions are met.

‌

Address resolution

This function is similar to ARP in IPv4. An IPv6 node acquires the link-layer addresses of neighboring nodes on the same link through NS and NA messages.

Figure 1 shows how Host A acquires the link-layer address of Host B on the same link. The address resolution procedure is as follows:

1. Host A multicasts an NS message. The source address of the NS message is the IPv6 address of the sending interface of Host A. The destination address is the solicited-node multicast address of Host B. The NS message body contains the link-layer address of Host A and the target IPv6 address.

2. After receiving the NS message, Host B determines whether the target address of the packet is its IPv6 address. If it is, Host B learns the link-layer address of Host A, and then unicasts an NA message containing its link-layer address.

3. Host A acquires the link-layer address of Host B from the NA message.

Figure 1 Address resolution

‌

Neighbor reachability detection

After Host A acquires the link-layer address of its neighbor Host B, Host A can use NS and NA messages to test the reachability of Host B as follows:

1. Host A sends an NS message whose destination address is the IPv6 address of Host B.

2. If Host A receives an NA message from Host B, Host A decides that Host B is reachable. Otherwise, Host B is unreachable.

Duplicate address detection

After Host A acquires an IPv6 address, it performs Duplicate Address Detection (DAD) to check whether the address is being used by any other node. This is similar to gratuitous ARP in IPv4. DAD is accomplished through NS and NA messages.

The DAD procedure is as follows:

1. Host A sends an NS message. The source address is the unspecified address and the destination address is the corresponding solicited-node multicast address of the IPv6 address to be detected. The NS message body contains the detected IPv6 address.

2. If Host B uses this IPv6 address, Host B returns an NA message that contains its IPv6 address.

3. Host A knows that the IPv6 address is being used by Host B after receiving the NA message from Host B. If receiving no NA message, Host A decides that the IPv6 address is not in use and uses this address.

Figure 2 Duplicate address detection

‌

Router/prefix discovery and stateless address autoconfiguration

Router/prefix discovery allows an IPv6 node to find the neighboring routers and learn the prefix and network configuration parameters of the network from receiving RA messages.

Stateless address autoconfiguration allows an IPv6 node to automatically generate an IPv6 address based on the information learned through router/prefix discovery.

A node performs router/prefix discovery and stateless address autoconfiguration as follows:

1. At startup, a node sends an RS message to request configuration information from a router.

2. The router returns an RA message containing the Prefix Information option and other configuration information. (The router also periodically sends an RA message.)

3. The node automatically generates an IPv6 address and other configuration parameters according to the configuration information in the RA message.

The Prefix Information option contains an address prefix and the preferred lifetime and valid lifetime of the address prefix. A node updates the preferred lifetime and valid lifetime upon receiving a periodic RA message.

The generated IPv6 address is valid within the valid lifetime and becomes invalid when the valid lifetime expires.

After the preferred lifetime expires, the node cannot use the generated IPv6 address to establish new connections, but can receive packets destined for the IPv6 address. The preferred lifetime cannot be greater than the valid lifetime.

Redirection

Upon receiving a packet from a host, the gateway sends an ICMPv6 redirect message to inform the host of a better next hop when the following conditions are met:

· The interface receiving the packet is the same as the interface forwarding the packet.

· The selected route is not created or modified by an ICMPv6 redirect message.

· The selected route is not a default route on the device.

Protocols and standards

· RFC 4861, Neighbor Discovery for IP Version 6 (IPv6)

· RFC 8106, IPv6 Router Advertisement Options for DNS Configuration

IPv6 neighbor discovery tasks at a glance

All IPv6 neighbor discovery tasks are optional.

· Configuring ND entry related features

¡ Configuring a static neighbor entry

¡ Setting the dynamic neighbor learning limit on an interface

¡ Enabling unsolicited NA learning

¡ Setting the aging timer for ND entries in stale state

¡ Minimizing link-local ND entries

· Setting the hop limit

· Configuring RA message sending and parameters

· Setting the maximum number of attempts to send an NS message for DAD

· Configuring ND snooping

¡ Configuring ND snooping in a VLAN

· Enabling ND proxy

¡ Enabling common ND proxy

¡ Enabling span-segment ND proxy

¡ Enabling local ND proxy

· Configuring IPv6 ND direct route advertisement

· Configuring user information recording

¡ Enabling recording user IPv6 address conflicts

¡ Enabling recording user port migrations

¡ Enabling ND logging for user online and offline events

· Enabling unique ND entry learning for IPv6 address

Configuring a static neighbor entry

About this task

A neighbor entry stores information about a link-local node. The entry can be created dynamically through NS and NA messages, or configured statically.

The device uniquely identifies a static neighbor entry by using the neighbor's IPv6 address and the number of the Layer 3 interface that connects to the neighbor. You can configure a static neighbor entry by using one of the following methods:

· Method 1—Associate a neighbor's IPv6 address and link-layer address with the local Layer 3 interface.

· Method 2—Associate a neighbor's IPv6 address and link-layer address with a Layer 2 port in a VLAN.

Restrictions and guidelines

To configure a static neighbor entry for a VLAN interface, use Method 1 or Method 2.

· If you use Method 1, the device is required to resolve the Layer 2 port in the related VLAN.

· If you use Method 2, make sure the Layer 2 port belongs to the specified VLAN and the corresponding VLAN interface already exists. After the configuration, the device associates the VLAN interface with the neighbor IPv6 address to identify the static neighbor entry.

To delete a neighbor entry for a VLAN interface, specify only the VLAN interface.

Procedure

1. Enter system view.

system-view

2. Configure a static neighbor entry.

ipv6 neighbor ipv6-address mac-address { vlan-id port-type port-number | interface interface-type interface-number } [ vpn-instance vpn-instance-name ]

By default, no static neighbor entries exist.

Setting the dynamic neighbor learning limit on an interface

About this task

The device can dynamically acquire the link-layer address of a neighboring node through NS and NA messages and add it into the neighbor table. When the number of dynamic neighbor entries reaches the limit, the interface stops learning neighbor information.

This feature limits the neighbor table size. A large neighbor table will degrade the forwarding performance.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Set the dynamic neighbor learning limit on the interface.

ipv6 neighbors max-learning-num max-number

By default, the dynamic ND entry learning limit for an interface depends on the configuration of the hardware-mode command. For information about the hardware-mode command, see hardware resource management configuration in System Management Configuration Guide.

Enabling unsolicited NA learning

About this task

On some networks, a server multicasts NA messages to two peer devices for link backup. The peer devices cannot learn ND entry for the server from these NA messages by default. If no ND learning is triggered by data exchange between the server and peer devices, the peer devices learn the entry for the server only when the server unicasts messages to them.

This feature enables an interface to learn ND entries from unsolicited NA messages. The ND entries generated by using this method are in stale state.

Restrictions and guidelines

To ensure that the device learns ND entries from trusted NA messages, enable this feature only on a secure network.

This feature might cause the device to learn excessive ND entries that consume too many system resources. As a best practice, execute the ipv6 neighbor stale-aging command to set a smaller aging timer before you enable this feature. The smaller aging timer accelerates the aging of ND entries in stale state.

This feature is available only on Layer 3 interfaces.

Procedure

1. Enter system view.

system-view

2. Enter Layer 3 interface view.

interface interface-type interface-number

3. Enable unsolicited NA learning.

ipv6 nd unsolicited-na-learning enable

By default, unsolicited NA learning is disabled.

Setting the aging timer for ND entries in stale state

About this task

ND entries in stale state have an aging timer. If an ND entry in stale state is not refreshed before the timer expires, the ND entry changes to the delay state. If it is still not refreshed in 5 seconds, the ND entry changes to the probe state, and the device sends an NS message three times. If no response is received, the device deletes the ND entry.

Restrictions and guidelines

You can set the aging timer for ND entries in stale state in system view and interface view. For ND entries in stale state on an interface, the aging timer in interface view has priority over the aging timer in system view.

Procedure

1. Enter system view.

system-view

2. Set the aging timer for ND entries in stale state.

¡ Set the aging timer for ND entries in stale state in system view.

ipv6 neighbor stale-aging { aging-minutes | second aging-seconds }

The default setting is 240 minutes.

¡ Execute the following commands in sequence to set the aging timer in interface view.

interface interface-type interface-number

ipv6 neighbor timer stale-aging { aging-minutes | second aging-seconds }

By default, the aging timer of ND entries in stale state is not configured on an interface. The aging timer is determined by the configuration of this command in system view.

Minimizing link-local ND entries

About this task

Perform this task to minimize link-local ND entries assigned to the hardware. Link-local ND entries refer to ND entries that contain link-local addresses.

By default, the device assigns all ND entries to the hardware. With this feature enabled, the newly learned link-local ND entries are not assigned to the hardware if the link-local addresses of the entries are not the next hops of any routes. This feature saves hardware resources.

This feature takes effect only on newly learned link-local ND entries.

Procedure

1. Enter system view.

system-view

2. Minimize link-local ND entries.

ipv6 neighbor link-local minimize

By default, the device assigns all ND entries to the hardware.

Setting the hop limit

About this task

You can set the hop limit value to fill in the Hop Limit field for IPv6 packets to be sent.

Procedure

1. Enter system view.

system-view

2. Set the value for the Hop Limit field in the IP header.

ipv6 hop-limit value

The default setting is 64.

Configuring RA message sending and parameters

About RA message parameters

You can enable an interface to send RA messages, and configure the interval for sending RA messages and parameters in RA messages. After receiving an RA message, a host can use these parameters to perform corresponding operations. Table 2 describes the configurable parameters in an RA message.

Table 2 Parameters in an RA message and their descriptions

Parameter	Description
Hop Limit	Maximum number of hops in RA messages. A host receiving the RA message fills the value in the Hop Limit field of sent IPv6 packets.
Prefix information	After receiving the prefix information, the hosts on the same link can perform stateless autoconfiguration.
MTU	Guarantees that all nodes on the link use the same MTU.
M flag	Determines whether a host uses stateful autoconfiguration to obtain an IPv6 address. If the M flag is set to 1, the host uses stateful autoconfiguration (for example, from a DHCPv6 server) to obtain an IPv6 address. Otherwise, the host uses stateless autoconfiguration to generate an IPv6 address according to its link-layer address and the prefix information in the RA message.
O flag	Determines whether a host uses stateful autoconfiguration to obtain configuration information other than the IPv6 address. If the O flag is set to 1, the host uses stateful autoconfiguration (for example, from a DHCPv6 server) to obtain configuration information other than the IPv6 address. Otherwise, the host uses stateless autoconfiguration.
Router Lifetime	Tells the receiving hosts how long the advertising router can live. If the lifetime of a router is 0, the router cannot be used as the default gateway.
Retrans Timer	If the device does not receive a response message within the specified time after sending an NS message, it retransmits the NS message.
Reachable Time	If the neighbor reachability detection shows that a neighbor is reachable, the device considers the neighbor reachable within the specified reachable time. If the device needs to send a packet to the neighbor after the specified reachable time expires, the device reconfirms whether the neighbor is reachable.
Router Preference	Specifies the router preference in an RA message. A host selects a router as the default gateway according to the router preference. If router preferences are the same, the host selects the router from which the first RA message is received.
DNS server option	DNS server information for IPv6 hosts. Hosts can obtain DNS server information from received RA messages instead of using DHCPv6.
DNS suffix information in DNS Search List (DNSSL) option	DNS suffix information for IPv6 hosts. Hosts can obtain DNS suffix information from received RA messages instead of using DHCPv6.

‌

Restrictions and guidelines

The maximum interval for sending RA messages should be less than (or equal to) the router lifetime in RA messages. In this way, the router can be updated by an RA message before expiration.

The values of the NS retransmission timer and the reachable time configured for an interface are sent in RA messages to hosts. This interface sends NS messages at the interval of the NS retransmission timer and considers a neighbor reachable within the reachable time.

Enabling the sending of RA messages

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable the sending of RA messages.

undo ipv6 nd ra halt

The default setting is disabled.

4. Set the maximum and minimum intervals for sending RA messages.

ipv6 nd ra interval max-interval min-interval

By default, the maximum interval for sending RA messages is 600 seconds, and the minimum interval is 200 seconds.

The device sends RA messages at random intervals between the maximum interval and the minimum interval.

The minimum interval should be less than or equal to 0.75 times the maximum interval.

Configuring parameters for RA messages

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Configure the prefix information in RA messages.

ipv6 nd ra prefix { ipv6-prefix prefix-length | ipv6-prefix/prefix-length } [ valid-lifetime preferred-lifetime [ no-autoconfig | off-link ] * | no-advertise ]

By default, no prefix information is configured for RA messages, and the IPv6 address of the interface sending RA messages is used as the prefix information. If the IPv6 address is manually configured, the prefix uses a fixed valid lifetime of 2592000 seconds (30 days) and a preferred lifetime of 604800 seconds (7 days). If the IPv6 address is automatically obtained, the prefix uses the valid lifetime and preferred lifetime configured for the IPv6 address.

4. Configure the default settings for prefixes advertised in RA messages.

ipv6 nd ra prefix default [ valid-lifetime preferred-lifetime [ no-autoconfig | off-link ] * | no-advertise ]

By default, no default settings are configured for prefixes advertised in RA messages.

5. Turn off the MTU option in RA messages.

ipv6 nd ra no-advlinkmtu

By default, RA messages contain the MTU option.

6. Specify unlimited hops in RA messages.

ipv6 nd ra hop-limit unspecified

By default, the maximum number of hops in RA messages is 64.

7. Specify the URL of the boot file in RA messages.

ipv6 nd ra boot-file-url url-string

By default, RA messages do not contain the URL of the boot file.

8. Set the M flag bit to 1.

ipv6 nd autoconfig managed-address-flag

By default, the M flag bit is set to 0 in RA advertisements. Hosts receiving the advertisements will obtain IPv6 addresses through stateless autoconfiguration.

9. Set the O flag bit to 1.

ipv6 nd autoconfig other-flag

By default, the O flag bit is set to 0 in RA advertisements. Hosts receiving the advertisements will acquire other configuration information through stateless autoconfiguration.

10. Set the router lifetime in RA messages.

ipv6 nd ra router-lifetime time

By default, the router lifetime is three times as long as the maximum interval for advertising RA messages.

11. Set the NS retransmission timer.

ipv6 nd ns retrans-timer value

By default, an interface sends NS messages every 1000 milliseconds, and the value of the Retrans Timer field in RA messages is 0.

12. Set the router preference in RA messages.

ipv6 nd router-preference { high | low | medium }

By default, the router preference is medium.

13. Set the reachable time.

ipv6 nd nud reachable-time time

By default, the neighbor reachable time is 30000 milliseconds, and the value of the Reachable Time field in sent RA messages is 0.

Specifying DNS server information in RA messages

About this task

The DNS server options in RA messages provide DNS server information for IPv6 hosts. The RA messages allow hosts to obtain their IPv6 addresses and the DNS server through stateless autoconfiguration. This method is useful in a network where DHCPv6 infrastructure is not provided.

One DNS server option contains one DNS server. All DNS server options are sorted in ascending order of the DNS server sequence number.

After you execute the ipv6 nd ra dns server command, the device immediately sends an RA message with the existing and newly specified DNS server information.

After you execute the undo ipv6 nd ra dns server command, the device immediately sends two RA messages.

The first RA message contains information about all DNS servers, including the DNS servers specified in the undo command with their lifetime set to 0 seconds.

· The second RA message contains information about remaining DNS servers.

Each time the device sends an RA message from an interface, it immediately refreshes the RA message advertisement interval for that interface.

Restrictions and guidelines

You can configure a maximum of eight DNS servers on an interface.

The default lifetime of a DNS server is three times the maximum interval for advertising RA messages. To set the maximum interval, use the ipv6 nd ra interval command.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Specify DNS server information to be advertised in RA messages.

ipv6 nd ra dns server ipv6-address [ seconds | infinite ] sequence seqno

By default, no DNS server information is specified and RA messages do not contain DNS server options.

Specifying DNS suffix information in RA messages

About this task

The DNSSL option in RA messages provides suffix information for IPv6 hosts. The RA messages allow hosts to obtain their IPv6 addresses and the DNS suffix through stateless autoconfiguration. This method is useful in a network where DHCPv6 infrastructure is not provided.

One DNSSL option contains one DNS suffix. All DNSSL options are sorted in ascending order of the sequence number of the DNS suffix.

After you execute the ipv6 nd ra dns search-list command, the device immediately sends an RA message with the existing and newly specified DNS suffix information.

After you execute the undo ipv6 nd ra dns search-list command, the device immediately sends two RA messages.

· The first RA message contains information about all DNS suffixes, including DNS suffixes specified in the undo command with their lifetime set to 0 seconds.

· The second RA message contains information about remaining DNS suffixes.

Each time the device sends an RA message from an interface, it immediately refreshes the RA message advertisement interval for that interface.

Restrictions and guidelines

You can configure a maximum of eight DNS suffixes on an interface.

The default lifetime of a DNS suffix is three times the maximum interval for advertising RA messages. To set the maximum interval, use the ipv6 nd ra interval command.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Specify DNS suffix information to be advertised in RA messages.

ipv6 nd ra dns search-list domain-name [ seconds | infinite ] sequence seqno

By default, no DNS suffix information is specified and RA messages do not contain DNS suffix options.

Suppressing advertising DNS information in RA messages

About this task

Perform this task to suppress the device from advertising information about DNS server addresses and DNS suffixes in RA messages.

Whether enabling this feature on an interface will trigger sending RA message immediately depends on the interface configuration:

· If the interface has DNS server information configured or has obtained an AAA-authorized DNS server address, the device immediately sends two RA messages. In the first message, the lifetime for DNS server addresses is 0 seconds. The second RA message does not contain any DNS server options.

· If the interface has no DNS server information specified or no AAA-authorized DNS server address assigned, no RA messages are triggered.

If you specify a new DNS server or remove a DNS server on the interface after enabling DNS server suppression, the device immediately sends an RA message without any DNS server options.

Whether disabling this feature on an interface will trigger sending RA message immediately depends on the interface configuration:

· If the interface has DNS server information configured or has obtained an AAA-authorized DNS server address, the device immediately sends an RA message containing the DNS server information.

· If the interface has no DNS server information specified or no AAA-authorized DNS server address assigned, no RA messages are triggered.

Each time the device sends an RA message from an interface, it immediately refreshes the RA message advertisement interval for that interface.

The same suppression mechanism applies when you enable or disable DNS suffix suppression in RA messages.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable DNS server suppression in RA messages.

ipv6 nd ra dns server suppress

By default, DNS server suppression in RA messages is disabled.

4. Enable DNS suffix suppression in RA messages.

ipv6 nd ra dns search-list suppress

By default, DNS suffix suppression in RA messages is disabled.

Setting the maximum number of attempts to send an NS message for DAD

About this task

An interface sends an NS message for DAD for an obtained IPv6 address. The interface resends the NS message if it does not receive a response within the time specified by the ipv6 nd ns retrans-timer command. If the interface receives no response after making the maximum attempts specified by the ipv6 nd dad attempts command, the interface uses the IPv6 address.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Set the number of attempts to send an NS message for DAD.

ipv6 nd dad attempts times

The default setting is 1. When the times argument is set to 0, DAD is disabled.

Configuring ND snooping in a VLAN

About ND snooping in a VLAN

The ND snooping feature is used in Layer 2 switching networks. It learns the source MAC addresses, source IPv6 addresses, input interfaces, and VLANs of arriving ND messages and data packets to build the ND snooping table.

ND snooping entries can be used by ND detection to prevent spoofing attacks.

ND detection processes the ND messages received on ND trusted and untrusted interfaces as follows:

· ND detection forwards all ND messages received on an ND trusted interface.

· ND detection compares all ND messages received on an ND untrusted interface with the ND snooping entries except for RA and redirect messages.

You can use the ipv6 nd detection trust command to specify a Layer 2 Ethernet or aggregate port as an ND trusted interface. For more information about the ipv6 nd detection trust command, see Security Command Reference.

ND snooping provides device liveness tracking so that the ND snooping table can be updated in a timely manner. After ND snooping is enabled for a VLAN, the device uses the following mechanisms to create, update, and delete ND snooping entries. The following example uses ND messages for illustration.

Creation of ND snooping entries

Upon receiving an ND message or data packet from an unknown source, the device creates an ND snooping entry in INVALID status and performs DAD for the source IPv6 address. The device sends NS messages out of the ND trusted interfaces in the receiving VLAN twice. The sending interval is set by the ipv6 nd snooping dad retrans-timer command.

If the device does not receive an NA message within the invalid entry lifetime (set by the ipv6 nd snooping lifetime invalid command), the entry becomes valid.

· If the device receives an NA message within the invalid entry lifetime, it deletes this entry.

Updating of ND snooping entries

When the ND untrusted interface that receives an ND message is different from that in the entry for an IPv6 address, the device performs DAD for the entry. It sends NS messages twice. The sending interval is set by the ipv6 nd snooping dad retrans-timer command.

· If the device does not receive an NA message within the invalid entry lifetime, it updates the entry with the new receiving interface.

· If the device receives an NA message within the invalid entry lifetime, the ND snooping entry remains unchanged.

Deletion of ND snooping entries

When an ND trusted interface in the VLAN receives an ND message from the IPv6 address in a learned ND snooping entry, it performs DAD for the entry. The device sends NS messages twice. The sending interval is set by the ipv6 nd snooping dad retrans-timer command.

¡ If the device does not receive an NA message within the invalid entry lifetime, it deletes the entry.

¡ If the device receives an NA message within the invalid entry lifetime, the ND snooping entry remains unchanged.

If an ND snooping entry has no matching ND messages within the valid entry lifetime (set by the ipv6 nd snooping lifetime valid command), the entry becomes invalid. The device then performs DAD for the entry by sending NS messages out of the interface in the entry twice. The sending interval is set by the ipv6 nd snooping dad retrans-timer command.

¡ If the device does not receive an NA message within the invalid entry lifetime, it deletes the entry.

¡ If the device receives an NA message within the invalid entry lifetime, the ND snooping entry remains unchanged and becomes valid.

Procedure

1. Enter system view.

system-view

2. Enter VLAN view.

vlan vlan-id

3. Enable ND snooping for IPv6 addresses. Choose the options to configure as needed:

¡ Enable ND snooping for global unicast addresses.

ipv6 nd snooping enable global

¡ Enable ND snooping for link-local addresses.

ipv6 nd snooping enable link-local

By default, ND snooping is disabled for IPv6 global unicast addresses and link-local addresses.

4. (Optional.) Enable ND snooping for data packets from unknown sources.

ipv6 nd snooping glean source

By default, ND snooping is disabled for data packets from unknown sources.

Before executing this command for a VLAN, you must configure IPv6 source guard on all untrusted interfaces in the same VLAN. This operation ensures correct forwarding of the data packets received by all these interfaces.

5. Return to system view.

quit

6. Enter Layer 2 Ethernet or Layer 2 aggregate interface view.

interface interface-type interface-number

7. (Optional.) Set the maximum number of ND snooping entries that an interface can learn.

ipv6 nd snooping max-learning-num max-number

By default, an interface can learn a maximum of 4096 ND snooping entries.

8. (Optional.) Configure the port as an ND snooping uplink port. The ND snooping uplink port cannot learn ND snooping entries.

ipv6 nd snooping uplink

By default, the port is not an ND snooping uplink port. After ND snooping is enabled, the port can learn ND snooping entries.

9. Return to system view.

quit

10. (Optional.) Set timeout timers for ND snooping entries.

ipv6 nd snooping lifetime { invalid invalid-lifetime | valid valid-lifetime }

The default settings are as follows:

¡ The timeout timer for ND snooping entries in INVALID status (TENTATIVE, TESTING_TPLT, or TESTING_VP) is 500 milliseconds.

¡ The timeout timer for ND snooping entries in VALID status is 300 seconds.

11. (Optional.) Set the interval for retransmitting an NS message for DAD.

ipv6 nd snooping dad retrans-timer interval

The default value is 250 milliseconds.

Enabling ND proxy

About ND proxy

ND proxy enables a device to answer an NS message requesting the hardware address of a host on another network. With ND proxy, hosts in different broadcast domains can communicate with each other as they would on the same network.

ND proxy includes common ND proxy, span-segment ND proxy, and local ND proxy.

Common ND proxy

As shown in Figure 3, Interface A with IPv6 address 4:1::99/64 and Interface B with IPv6 address 4:2::99/64 belong to different subnets. Host A and Host B reside on the same network but in different broadcast domains.

Figure 3 Application environment of ND proxy

‌

To solve this problem, enable common ND proxy on Interface A and Interface B of the device. The device replies to the NS message from Host A, and forwards packets from other hosts to Host B.

Span-segment ND proxy

As shown in Figure 4, Interface A with IPv6 address 4:2::1/126 and Interface B with IPv6 address 4:3::1/126 belong to different subnets. Host A and Host B reside on the same network but in different broadcast domains.

Figure 4 Application environment of span-segment ND proxy

Because Host A's IPv6 address is on the same subnet as Host B's, Host A directly sends an NS message to obtain Host B's MAC address. However, Host B cannot receive the NS message because they belong to different broadcast domains. The device cannot receive the NS messages sent by Host A and Host B because IPv6 addresses of Interface A and Interface B are in different subnets.

To solve this problem, enable span-segment ND proxy on Interface A and Interface B of the device. The device replies to the NS messages from Host A and Host B, and forwards packets from other hosts to Host A and Host B.

Local ND proxy

As shown in Figure 5, Host A belongs to VLAN 2 and Host B belongs to VLAN 3. Host A and Host B connect to Port B1 and Port B3, respectively.

Figure 5 Application environment of local ND proxy

‌

To solve this problem, enable local ND proxy on Interface A of Device A so that Device A can forward messages between Host A and Host B.

Local ND proxy implements Layer 3 communication for two hosts in the following cases:

· The two hosts connect to ports of the same device and the ports must be in different VLANs.

· The two hosts connect to isolated Layer 2 ports in the same isolation group of a VLAN.

Enabling common ND proxy

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable common ND proxy.

proxy-nd enable

By default, common ND proxy is disabled.

Enabling span-segment ND proxy

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable span-segment ND proxy.

proxy-nd span-segment enable

By default, span-segment ND proxy is disabled.

Enabling local ND proxy

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable local ND proxy.

local-proxy-nd enable

By default, local ND proxy is disabled.

Configuring IPv6 ND direct route advertisement

About IPv6 ND direct route advertisement

This feature generates 128-bit host routes based on ND entries for packet forwarding and route advertisement. The route preference value determines the match order of a route. Dynamic routing protocols use the tag value as the route identifier when redistributing a direct route.

After you enable this feature, the routing table might be populated with excessive host routes. To reduce the routing table size, execute the ipv6 nd route-direct prefix convert-length command for the device to generate network routes for identified ND entries and delete the generated host routes.

In scenarios where network routes and host routes are both required, specify the retain-host-route keyword to retain the generated host routes. In other scenarios, to avoid too many host routes, do not specify the retain-host-route keyword.

After you enable ND direct route advertisement, the device generates direct routes based on ND entries. If the direct routes are generated before the ND entries, packet loss will occur due to lack of Layer 2 information during packet encapsulation. To avoid such an issue, set the delay time for ND direct route generation.

When you enable ND direct route advertisement and set the delay time for ND direct route generation, the device generates ND direct routes when the delay time is reached. If you edit the preference or route tag for direct routes within the delay time, the device advertises direct routes with the newly specified preference or route tag immediately.

Application in Layer 3 access networks

As shown in Figure 6, ND direct route advertisement is enabled on Interface A and Interface B. This feature generates a host route to Server A and a host route to Server B for the routing protocols to advertise. So each device forwards only the traffic destined to the server within the network, which saves bandwidth.

Figure 6 Application in a Layer 3 access network

‌

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. (Optional.) Set the delay time for ND direct route generation.

ipv6 nd route-direct advertise delay delay-time

By default, ND direct route generation is not delayed.

4. Enable ND direct route advertisement.

ipv6 nd route-direct advertise [ preference preference-value | tag tag-value ] *

By default, ND direct route advertisement is disabled.

5. (Optional.) Specify a prefix length for generating a network route for identified ND entries.

ipv6 nd route-direct prefix ipv6-prefix prefix-length convert-length convert-length [ retain-host-route ]

By default, no prefix length is specified for generating a network route for identified ND entries.

The specified IPv6 prefix takes effect only if it is the same as the prefix for the IPv6 address configured for the interface.

Enabling recording user IPv6 address conflicts

About this task

This feature detects and records user IPv6 address conflicts. A conflict occurs if an incoming NA packet has the same source IP address as an existing ND entry but a different source MAC address. The device generates a user IPv6 address conflict record, logs the conflict, and sends the log to the information center. For information about the log destination and output rule configuration in the information center, see the information center in System Management Configuration Guide.

Procedure

1. Enter system view.

system-view

2. Enable recording user IPv6 address conflicts.

ipv6 nd user-ip-conflict record enable

By default, recording user IPv6 address conflicts is disabled.

Enabling recording user port migrations

About this task

This feature enables the device to detect and record user port migrations. A user port migrates if an incoming NA packet has the same source IPv6 address and source MAC address as an existing ND entry but a different ingress port. The device generates a user port migration record, logs the migration event, and sends the log to the information center. For information about the log destination and output rule configuration in the information center, see the information center in System Management Configuration Guide.

Procedure

1. Enter system view.

system-view

2. Enable recording user port migrations.

ipv6 nd user-move record enable

By default, recording user port migrations is disabled.

Enabling ND logging for user online and offline events

About this task

This feature enables the device to generate user online or offline logs upon such events and send these logs to the information center. For information about the log destination and output rule configuration in the information center, see the information center in System Management Configuration Guide.

Restrictions and guidelines

A higher log output rate consumes more CPU resources. Adjust the log output rate based the CPU performance and usage.

Procedure

1. Enter system view.

system-view

2. Enable ND logging for user online and offline events.

ipv6 nd online-offline-log enable [ rate rate ]

By default, ND logging for user online and offline events is disabled.

Enabling unique ND entry learning for IPv6 addresses

About this task

This feature enables the device to learn only one ND entry for one IPv6 address. It is applicable to the following scenario:

As shown in Figure 7, when the host connects to Interface A, the device learns an ND entry in which the IPv6 address is 1::1 and the output interface is Interface A. When the host migrates to Interface B, the device might learn an ND entry in which the IPv6 address is 1::1 and the output interface is Interface B.

The forwarding entry for the host is generated based on the first ND entry. In the forwarding entry, the output interface for IP address 1::1 is Interface A. However, the current access interface of the host is Interface B. As a result, traffic cannot be forwarded normally for the host based on the forwarding entry. To resolve this issue, enable this feature on the device. The device deletes the old ND entry to ensure normal traffic forwarding.

Figure 7 Network diagram

‌

Procedure

1. Enter system view.

system-view

2. Enable unique ND entry learning for IPv6 addresses.

ipv6 nd ip-unique learning enable

By default, unique ND entry learning for IPv6 addresses is disabled.

Verifying and maintaining IPv6 ND

Displaying and clearing IPv6 neighbor information

Displaying IPv6 neighbor information

Perform display tasks in any view.

· Display IPv6 neighbor information.

display ipv6 neighbors { { ipv6-address | all | dynamic | static } [ slot slot-number ] | interface interface-type interface-number | vlan vlan-id } [ verbose ]

· Display IPv6 neighbor information for a VPN.

display ipv6 neighbors vpn-instance vpn-instance-name [ count ]

· Display user IPv6 address conflict records.

display ipv6 nd user-ip-conflict record [slot slot-number ]

· Display user port migration records.

display ipv6 nd user-move record [ slot slot-number ]

· Display the total number of IPv6 neighbor entries.

display ipv6 neighbors { { all | dynamic | static } [ slot slot-number ] | interface interface-type interface-number | vlan vlan-id } count

· Display the maximum number of ND entries that a device supports.

display ipv6 neighbors entry-limit

· Display ND entry statistics.

display ipv6 neighbors statistics { [ by-slot ] all | interface { interface-name | interface-type interface-number } | slot slot-number }

Clearing IPv6 neighbor information

To clear IPv6 neighbor information, execute the following command in user view:

reset ipv6 neighbors { all | dynamic | interface interface-type interface-number | slot slot-number | static }

Displaying and clearing IPv6 ND snooping information

Displaying information about IPv6 ND snooping entries

Perform display tasks in any view.

· Display the number of IPv6 ND snooping entries for VLANs.

display ipv6 nd snooping count vlan [ interface interface-type interface-number ]

· Display IPv6 ND snooping entries in VLANs.

display ipv6 nd snooping vlan [ [ vlan-id | interface interface-type interface-number ] [ global | link-local ] | ipv6-address ] [ verbose ]

Clearing IPv6 ND snooping entries

Perform clear tasks in user view.

· Clear IPv6 ND snooping entries in VLANs.

reset ipv6 nd snooping vlan { [ vlan-id ] [ global | link-local ] | vlan-id ipv6-address }

Displaying statistics about ND proxy

Displaying statistics about ND proxy reply packets

Perform display tasks in any view.

· Display statistics about ND proxy reply packets.

display ipv6 nd proxy statistics

IPv6 ND configuration examples

Example: Configuring ND snooping

Network configuration

As shown in Figure 8, Host A and Host B are connected to the gateway through Device B. Enable ND snooping on Device B to learn ND snooping entries about Host A and Host B.

Figure 8 Network diagram

‌

Procedure

1. Configure Device A:

# Create VLAN 10.

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] quit

# Configure Twenty-FiveGigE 1/0/3 to trunk VLAN 10.

[DeviceA] interface twenty-fivegige 1/0/3

[DeviceA-Twenty-FiveGigE1/0/3] port link-type trunk

[DeviceA-Twenty-FiveGigE1/0/3] port trunk permit vlan 10

[DeviceA-Twenty-FiveGigE1/0/3] quit

# Assign IPv6 address 10::1/64 to VLAN-interface 10.

[DeviceA] interface vlan-interface 10

[DeviceA-Vlan-interface10] ipv6 address 10::1/64

[DeviceA-Vlan-interface10] quit

2. Configure Device B:

# Create VLAN 10.

[DeviceB] vlan 10

[DeviceB-vlan10] quit

# Configure Twenty-FiveGigE 1/0/1, Twenty-FiveGigE 1/0/2, and Twenty-FiveGigE 1/0/3 to trunk VLAN 10.

[DeviceB] interface twenty-fivegige 1/0/1

[DeviceB-Twenty-FiveGigE1/0/1] port link-type access

[DeviceB-Twenty-FiveGigE1/0/1] port access vlan 10

[DeviceB-Twenty-FiveGigE1/0/1] quit

[DeviceB] interface twenty-fivegige 1/0/2

[DeviceB-Twenty-FiveGigE1/0/2] port link-type access

[DeviceB-Twenty-FiveGigE1/0/2] port access vlan 10

[DeviceB-Twenty-FiveGigE1/0/2] quit

[DeviceB] interface twenty-fivegige 1/0/3

[DeviceB-Twenty-FiveGigE1/0/3] port link-type trunk

[DeviceB-Twenty-FiveGigE1/0/3] port trunk permit vlan 10

[DeviceB-Twenty-FiveGigE1/0/3] quit

# Enable ND snooping for global unicast addresses and link-local addresses in VLAN 10.

[DeviceB] vlan 10

[DeviceB-vlan10] ipv6 nd snooping enable global

[DeviceB-vlan10] ipv6 nd snooping enable link-local

# Enable ND snooping for data packets from unknown sources in VLAN 10.

[DeviceB-vlan10] ipv6 nd snooping glean source

[DeviceB-vlan10] quit

# Configure Twenty-FiveGigE 1/0/3 as ND trusted interface.

[DeviceB] interface twenty-fivegige 1/0/3

[DeviceB-Twenty-FiveGigE1/0/3] ipv6 nd detection trust

[DeviceB-Twenty-FiveGigE1/0/3] quit

# Configure Twenty-FiveGigE 1/0/1 to learn a maximum number of 200 ND snooping entries.

[DeviceB] interface twenty-fivegige 1/0/1

[DeviceB-Twenty-FiveGigE1/0/1] ipv6 nd snooping max-learning-num 200

[DeviceB-Twenty-FiveGigE1/0/1] quit

# Configure Twenty-FiveGigE 1/0/2 to learn a maximum number of 200 ND snooping entries.

[DeviceB] interface twenty-fivegige 1/0/2

[DeviceB-Twenty-FiveGigE1/0/2] ipv6 nd snooping max-learning-num 200

[DeviceB-Twenty-FiveGigE1/0/2] quit

Verifying the configuration

# Verify that Device B has learned ND snooping entries for Host A and Host B.

[DeviceB] display ipv6 nd snooping vlan 10

IPv6 address MAC address VID Interface Status Age

10::5 0001-0203-0405 10 WGE1/0/1 VALID 157

10::6 0001-0203-0607 10 WGE1/0/2 VALID 105

05-Layer 3—IP Services Configuration Guide

About this task

Restrictions and guidelines

Procedure

About this task

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Procedure

About this task

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Procedure

About this task

Procedure

Creation of ND snooping entries

Updating of ND snooping entries

Deletion of ND snooping entries

About this task

Procedure

About this task

Procedure

About this task

Restrictions and guidelines

Procedure

Enabling unique ND entry learning for IPv6 addresses

About this task

Procedure

Displaying IPv6 neighbor information

Clearing IPv6 neighbor information

Displaying information about IPv6 ND snooping entries

Clearing IPv6 ND snooping entries

Displaying statistics about ND proxy reply packets

IPv6 ND configuration examples

Network configuration

Procedure

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us